OpenAI personnel found the device on September 30, concealed in toilet paper and plugged into a USB port behind a television. Investigators described its stored contents as encrypted and inaccessible. Prosecutors also allege that a second, similar device was found in a bag linked to Alfozan.
Reuters described the device as thumb-sized, with a microphone and the capability to connect to a camera. Neither the complaint nor the reporting says a camera was installed, or that any recording was transmitted anywhere.
The complaint was unsealed on 13 October. It charges Abdulrahman Alfozan, a 35-year-old Saudi national who had worked as an OpenAI engineer since July 2025, with using or attempting to use a device to intercept oral communications. He was arrested on 9 October, appeared in federal court on 13 October, and remains in custody ahead of a detention hearing on 19 October.
A room he had no reason to be in
According to the complaint, the executive conference room was routinely used for confidential discussions involving proprietary research, product plans, business opportunities, government engagements and commercial relationships. Prosecutors allege that Alfozan had no authority to access the room or participate in its meetings.
The evidence described so far is conventional rather than exotic. CCTV placed him near the room on several dates before the device was found, and again on 5 October apparently looking behind the television. Before the device was installed, internal searches attributed to him asked about building addresses, meeting rooms, calendars and where leadership and external partners met. Chatbot prompts in the last week of September — submitted from an account associated with his spouse that shared identifiers with his own account — asked about building, customising, installing and encrypting a recording device, including prompts that referenced the specific device. The complaint does not allege that his spouse typed the prompts or took any part in the matter. On 5 October, OpenAI security opened a bag he had left unattended and found his wallet, his ID and the second device.
OpenAI says its internal AI models helped analyze the device and identify the employee it believed had planted it. The DOJ's public account separately describes surveillance footage, internal searches, chatbot prompts and a second device found in a bag. Neither account establishes how much the AI analysis contributed to the investigation. OpenAI also says it found evidence suggesting an intention to place additional devices in sensitive areas; that is the company's assessment, not a proven plan.
Two statements that do not answer each other
OpenAI says it found no indication that Alfozan improperly accessed or exfiltrated model weights, source code or customer data. That statement does not establish what, if anything, the concealed recorder captured. Although senior officials framed the case in national-security terms and referred to foreign threats, the DOJ announcements do not allege that a foreign government directed Alfozan or that recordings were transmitted outside OpenAI. His motive remains unestablished.
Prosecutors allege that Alfozan used or attempted to use a concealed device to intercept confidential conversations. OpenAI separately says it found evidence suggesting plans for additional devices. If convicted, he faces up to five years in prison, a $250,000 fine and three years of supervised release. The complaint is an allegation, and he is presumed innocent unless proven guilty beyond a reasonable doubt. His next scheduled appearance is an October 19 detention hearing.
Sources
- [1] U.S. Department of Justice, U.S. Attorney's Office for the Northern District of California, press release, 13 October 2026 — primary source for the charge, the arrest and court dates, the device timeline, and the CCTV, internal-search, chatbot-prompt and second-device allegationsRead source
- [2] U.S. Department of Justice, Office of Public Affairs announcement, 13 October 2026 — primary source for the senior officials' national-security framingRead source
- [3] Reuters, 13 October 2026, syndicated copy via WNCY — wire report for the thumb-sized device description, the encrypted and inaccessible stored data, and OpenAI's statements that its internal AI models helped identify the employee and that it found no indication of model weights, source code or customer data being takenRead source